Quantum key distribution and 1 Gbit/s data encryption over a single fibre 
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We perform quantum key distribution (QKD) in the presence of 4 classical channels in a C-band 
dense wavelength division multiplexing (DWDM) configuration using a commercial QKD system. 
The classical channels are used for key distillation and 1 Gbps encrypted communication, rendering 
the entire system independent from any other communication channel than a single dedicated fibre. 
We successfully distil secret keys over fibre spans of up to 50 km. The separation between quantum 
channel and nearest classical channel is only 200 GHz, while the classical channels are all separated 
by 100 GHz. In addition to that we discuss possible improvements and alternative configurations, 
for instance whether it is advantageous to choose the quantum channel at 1310 nm or to opt for a 
pure C-band configuration. 



I. INTRODUCTION 

Since the initial proposal of quantum key distribution 
(QKD) in 1984 1] and its first experimental demonstra- 
tion [2], major progresses in long-distance, fibre-based 
point-to-point QKD have been achieved (for an overview 
over current state-of-the-art implementations, see Q). 

Until recently, one of the specifics of QKD systems 
was the need for a dedicated dark optical fibre, exclu- 
sively reserved for the quantum channel (single photon 
level). Signals of classical strength, used to perform key 
distillation and encrypted communication between the 
end users, were sent through a second fibre to not com- 
promise the weak quantum signal. 

The next consequential step towards larger availability 
of QKD links is to look at the compatibility of QKD with 
existing fibre infrastructure. Common public DWDM 
(dense wavelength division multiplexing) networks mul- 
tiplex up to 50 different wavelength channels on a single 
fibre. If the quantum channel is launched into a fibre ac- 
companied with other classical signals, several effects like 
channel crosstalk, Raman scattering, four-wave mixing or 
amplified spontaneous emission (in case of amplification 
of the classical channels) can severely degrade QKD sys- 
tem operation or worse, can prevent it at all. 

First investigations in this direction were conducted by 
Townsend in the late nineties [i| . The impact of a single 
classical C-band channel, wavelength multiplexed with 
a quantum channel at 1310 nm, was analyzed. Later, 
in 2005, Lee and Wellbrock demonstrated quantum key 
distribution, placing both the quantum channel and one 
classical channel into the C-band with a separation of 
down to 400 GHz equivalent to 3.2 nm [5j. We note 
that the classical channel was neither linked to QKD 
system operation nor used for encrypted communication. 
More recent works [f| 0] investigate different impairment 
sources on a more general level, including effects which 
occur when more than one classical channel is present, 
e.g. four-wave mixing. 

Apart from the long term goal of QKD operation on 



public DWDM networks, another frequently encountered 
network topology could push forward QKD availability 
on a short term scale. In order to accommodate future 
growth, telecom companies have spent the last few years 
installing point-to-point dedicated fibres. These fibres 
can also be used in the standard configuration of QKD 
using a dark fibre for the quantum channel and another 
for the encrypted communication. However, for reasons 
of availability and fibre leasing costs the operation on 
only one fibre is highly desirable. 

In this paper we investigate exactly this situation 
where in total only one dedicated fibre is available and 
an encrypted link, based on QKD, should be established 
between its endpoints. This objective thus necessitates 
the wavelength multiplexing of all system relevant chan- 
nels, i.e. key distillation- and encrypted communication 
channels as well as the quantum channel on a single fibre. 
If one is not obliged to operate in a two fibre configura- 
tion, then in particular QKD systems which require a 
classical clock signal to synchronize the separate devices 
would benefit from higher robustness against fibre drifts. 
Furthermore, the configuration investigated here surely 
bears the advantage of having perfect information on the 
classical channels, while they are difficult to assess in the 
public network configuration. Therefore a reliable perfor- 
mance characterisation of the entire system is obtainable. 

In our experiment we use a standard 8 channel C-band 
DWDM with 100 GHz (corresponding to 0.8 nm) spac- 
ing. We simultaneously multiplex 4 classical channels 
(one bidirectional channel for distillation and encrypted 
1 Gbps communication, respectively) with a quantum 
channel, separated from the nearest classical channel by 
only 200 GHz. 

The paper is organized as follows: In Sec. [11] we discuss 
the different impairment sources relevant for our realiza- 
tion. Section Hill describes the QKD setup and presents 
the experimental results followed by a discussion and out- 
look in Sec. IIVI Section fVl contains our conclusions. 
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FIG. 1: Measured effective Raman cross-section p (A) (per km 
fibre length and nm bandwidth) for a pump laser wavelength 
centred at 1550 nm in a standard single mode fibre at room 
temperature. 



relation of optical phonons causes frequency shifts inde- 
pendent of the scatter direction. This means that in co- 
as well as in counter propagating direction (with respect 
to the exciting signal) a broad spectrum of photons is 
present. 

We measured the Raman scatter generated by a 50 
km standard single mode fibre and extracted an effective 
Raman scattering cross-section p(X), shown in Fig. [5] It 
is normalized with respect to spectral bandwidth and fi- 
bre length and accounts for the fibre caption ratio of the 
scattered light. In return, by means of p(X) and allowing 
for fibre attenuation we can calculate the Raman scatter 
power emerging from the input P ram ,b (backward Raman 
scattering) and output P ram ,f (forward Raman scatter- 
ing) of a fibre of arbitrary length L. Assuming a certain 
filter pass-band [A, A + AA] and approximating the spec- 
tral integration via 
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FIG. 2: Zoom on Anti-Stokes dip of the Raman spectrum. In 
channels +2 and +3 the minimal amount of Raman scatter is 
found. 



II. IMPAIRMENT SOURCES 



A+AA 

P (X')dX' m p(X) ■ AA 
we obtain (see Appendix A) 

PramJ = Pout ' L ■ p(X) ■ AA 



(1) 



(2) 



„ _ sinhia ■ L) . A , . , 

Pram,b = Pout 1 ■ p{X) • AA (3) 



where Pout is the power of the exciting laser at the fibre 
output in [W], a the fibre attenuation coefficient [km -1 ] 
and L the fibre length [km] . P ou t can be written in terms 
of the input power via P ou t — Pin • eT a ' L . The impact 
of each of the Raman contributions, represented by the 
detection probability per ns detector gate is depicted in 
Fig.H 

Note that we assume equal attenuation for initial and 
scattered wavelength, which is reasonable for our total 
wavelength span of 4 nm (see Sec. IIIII) . 



A. Raman scattering 

Due to photon-phonon interaction, photons can change 
their wavelength and thus compromise other channels. 
Depending on whether a phonon gets excited or de- 
exited, photons at wavelengths above (Stokes) and be- 
low (anti-Stokes) the initial wavelength are generated. 
Scattering off acoustic phonons (Brillouin scattering) is 
not critical, since the maximal frequency shift of the 
scattered photons is small (10 GHz, in backward di- 
rection) and therefore cannot reach adjacent channels 
on a 100 GHz grid. By contrast, scattering off optical 
phonons (Raman scattering) can lead to significant fre- 
quency shifts covering the entire C-band [261 ] . having an 
intensity maximum at a shift of about 13 THz (corre- 
sponding to a wavelength shift of 100 nm at 1550 nm). 
Unlike acoustic phonons, the more or less flat dispersion 



B. Channel crosstalk 

The relative strength of the classical channels requires 
a large DWDM isolation with respect to the quantum 
channel. As a reasonable benchmark for a sufficient iso- 
lation we propose the detector dark count probability. 
To calculate a typical value we need to consider the re- 
ceiver sensitivity of the transceiver modules used for the 
classical communication (see Sec. IIII[) . It conditions the 
necessary optical power to ensure error free detection. 

In our particular case the sensitivity which guaran- 
tees a bit error rate BER < 10~ 12 is equal to -28 dBm 
(Finisar FWLF-1631-xx). This power corresponds to ap- 
proximately 1.2 • 10 4 photons per ns. In order to atten- 
uate this photon number so that the detection probabil- 
ity per ns gate is of order of the dark count probability 
(5TQ- 6 ns -1 ) an isolation of about 80 dB is needed. Here 



3 



— — Raman backward 

— Raman forward 

— Dark counts 
Crosstalk 



10 20 30 40 50 60 

Fibre length L [km] 

FIG. 3: Different contributions to the total noise count prob- 
ability per ns detector gate assuming our system param- 
eters (DWDM channel isolation=82 dB, fibre loss Qds = 
0.21 dB/km, 4 classical channels each with a power of -28 dBm 
at the receiver, r\ — 0.07, internal components loss=2.65 dB). 



DSF or NZDSF). 

In addition to the stimulated case described before, it 
is also important to assess the noise contribution from 
spontaneous FWM. Spontaneous FWM allows the cre- 
ation of signal and idler frequencies f s , fi from each 
pump frequency f p , satisfying energy conservation via 
2f p = f s + fi- The efficient generation again depends on 
the phase-matching condition. Around the zero disper- 
sion wavelength the generated spectrum can be rather- 
broad, superposing the spectrum generated by Raman 
scattering Q • Following [9| we calculate that even in our 
most demanding configuration the "/PqL product is very 
small (= 0.002, for considerable contributions at least 
jPqL of about 0.1 is needed). This indicates that even 
when we were operating around the zero dispersion wave- 
length, spontaneous FWM can be neglected with respect 
to Raman scattering. 



III. EXPERIMENT 



we assume a detector efficiency of rj = 0.07 and internal 
components loss of 2.65 dB on Bob's side. 

Our standard 8-channel DWDM provides an isolation 
of 82 dB between non-adjacent channels which is just suf- 
ficient to match the before mentioned criteria, see Fig. [3] 
In the case of insufficient isolation, additional niters can 
further improve the isolation, however at the expense of 
additional insertion loss in the quantum channel. In 
particular, considering Raman scattering we find that 
crosstalk is not a limiting factor for long fibre lengths. 

Finally, we note that a sufficient isolation of the 
co-propagating quantum and classical channel entails 
that crosstalk from Rayleigh backscatter in a counter- 
propagating configuration can be neglected. 



C. Four- wave mixing 

Four-wave mixing (FWM) is mediated by the third or- 
der susceptibility and describes the generation of ad- 
ditional photon frequencies, different from those present 
in the initial fields. In contrast to Raman scattering 
no energy is transferred to or taken from the fibre, i.e. 
no phonon excitation or de-excitation takes place. Most 
harmful for our setup would be the degenerate case where 
two exciting frequencies /i, /a (assuming fx > fi) gen- 
erate side band frequencies / + = /i + (/i — f%) and 
f- = f% — (ft — fs). If the channel separation is not 
properly chosen, /+/- may coincide with the quantum 
channel pass-band. The generation efficiency depends on 
the phase-matching condition, as well as on the relative 
polarisation and propagation direction of the involved 
field frequency components. It is particularly easy to ful- 
fil around the zero dispersion wavelength, where it can 
corrupt even classical communication [8]. In Sec. IIIII we 
present a channel configuration which prevents efficient 
FWM generation, independent of the fibre type (SSMF, 



A. Setup 

For the experiments we adopt a commercial QKD sys- 
tem (Cerberis from idQuantique [Io|). As outlined in 
Fig. [4] this solution combines a QKD server for secure 
point-to-point key distribution, and Layer 2 encryption 
units to encode and decode messages with the key pro- 
vided by the quantum server for complete secure bidi- 
rectional communication between two distant partners, 
Alice and Bob. 

The QKD layer is based on a "plug & play" phase 
encoding quantum key distribution system where all op- 
tical and mechanical fluctuations are automatically and 
passively compensated [HI ■ Bob generates a sequence of 
optical pulses with a frequency of f rep = 5 MHz. It prop- 
agates through his unbalanced Mach-Zehnder interferom- 
eter such that each pulse is split into two orthogonally po- 
larized pulses which are separated by the interferometer 
imbalance. The sequence length is chosen to match twice 
the length of the storage line of L s sw 10 km at Alice's 
in order to avoid compromising Rayleigh backscatter. At 
Alice's, the major proportion of photons per pulse is used 
to trigger the classical detector Da in order to synchro- 
nize her device with Bob's. The remaining proportion is 
reflected at the Faraday mirror (FM), phase modulated 
by (/>a in accordance to Alice's choice of bit value and 
encoding base, attenuated by the variable optical atten- 
uator (VOA) to n photons per pulse and returned to Bob 
through the same fibre link. Due to the Faraday rotation, 
each pulse propagates along the contrary interferometer 
arm as before and interferes at the beam splitter (BS) in 
accordance to the phase difference between 4>a and Bob's 
base choice <\>b- All internal losses of Bob's optical com- 
ponents sum up to ts = 2.65 dB (excluding DWDMs 
and optional filters). 

The signals are detected by InGaAs avalanche photo 
diodes (APDs) operated in Geiger mode. The APDs are 
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FIG. 4: Setup scheme. APD: Avalanche photo diode, BS: Beam splitter, C: Circulator, D: Photo diode, F: Spectral filter 
(optional), FM: Faraday mirror, PBS: Polarizing beam splitter, VOA: Variable optical attenuator, <f>: Phase modulator. 



temperature stabilized at 220 K, gated using 1.5 ns long 
gates and with a dead time of r^ead = 10 fJ-s applied af- 
ter each detection to reduce the afterpulse probability to 
p ap « 0.008. Their detection efficiencies are 77 « 0.07 
at a dark count probability of pdc ~ 5 • 10 -6 ns -1 . Af- 
ter key sifting, optionally via the sifting protocols BB84 
or SARG [l2|, followed by fully implemented error cor- 
rection using the CASCADE algorithm [l3[ and privacy 
amplification using hashing functions based on Toeplitz 
matrices [lj], Alice and Bob remain with shared secret 
keys. The integrity of the public distillation communica- 
tion is ensured by a Wegman-Carter-type authentication 
scheme based on universal hashing functions [15j . 

The pair of Ethernet encryptors is periodically updated 
with the secret keys to establish a permanent AES-256 
encrypted 1 Gbps data link between Alice and Bob. The 
data to be encrypted are continuously provided by two 
1 Gbps streams of random bits from a network test sys- 
tem (EXFO PacketBlazer FTB-8510). We note that typ- 
ically the key refresh rate is once per minute which re- 
quires a secret key rate of at least 8.6 bps. In order to 
guarantee continuous operation the key refresh rate is 
temporarily reduced if the secret key rate drops below 
that limit. 

All in all, to completely operate the Cerberis system, 
four classical communication channels have to be set up 
between Alice and Bob in addition to the quantum chan- 
nel. The bidirectional communication for distillation, i.e. 
key sifting, error correction and privacy amplification, 
demands two authenticated channels, one from Alice to 
Bob and one from Bob to Alice. Similarly, two channels 
are required for the bidirectional encrypted data trans- 
mission between the encryptors. All classical commu- 
nication channels are implemented using standard opti- 
cal 2.67 Gbps DWDM SFP transceivers (Finisar FWLF- 
1631-xx). 

We multiplex the quantum channel along with the four 
classical channels using off-the-shelf 100 GHz DWDM 
modules (OptiWorks). The modules possess an inser- 
tion loss of 1.95 dB and an isolation of 59 dB (82 dB) 
for adjacent (non-adjacent) channels. The implemented 



channel configuration is shown in Fig. 0J For the quan- 
tum channel we choose a wavelength of 1551.72 nm on 
the ITU C-band grid. We take advantage of 10 % less 
Raman noise on the anti-Stokes side of the Raman spec- 
trum at ambient temperature (see Fig. (2) by placing all 
classical channels at higher wavelengths. To benefit from 
both, the considerably higher DWDM channel isolation 
for non-adjacent channels as well as from lower Raman 
noise we omit the adjacent channel and set up the quan- 
tum channel 200 GHz (1.6 nm) apart from the nearest 
classical channel. We minimize the direct impairment 
due to FWM by choosing the frequency difference be- 
tween two co-propagating channels such that no FWM 
frequency product is generated within the quantum chan- 
nel pass-band (see Sec. Ill C[) . 

The discussion of impairment sources has shown that 
in general the amount of noise impinging on the detec- 
tors increases with the total power present in the fibre. 
Hence, we reduce the power of the classical channels to 
the overall transmission losses using variable optical at- 
tenuators (VOA), such that the corresponding power at 
the receiver's end just matches the receiver sensitivity of 
-28 dBm. This corresponds to P out — —26.05 dBm in 
Eq. [21 [3] due to the insertion losses of our DWDM mod- 
ules. 

With the aim to further minimize the amount of Ra- 
man noise, we optionally add phase-shifted fibre Bragg 
grating filters (F) from aos [l6T | centred around the quan- 
tum channel wavelength in front of each APD. Their 
spectral bandwidth of 45 pm (fwhm) and extinction ra- 
tio of 14 dB entails a 85 % rejection of noise photons, 
outweighing the additional attenuation of 2 dB due to 
insertion loss. The filters are actively and indepen- 
dently temperature stabilized using standard tempera- 
ture controllers, mainly to permit fine adjustment of their 
transmission bandwidth. A straightforward configura- 
tion with only one filter inserted between the PBS and 
the DWDM was abandoned because of back reflections 
of the quantum channel laser which completely saturated 
the APDs. 
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TABLE I: The secret key rate R a ec and QBER values from Fig. [5] which we obtained experimentally using BB84 and SARG, 
without and with the spectral filters (F) . 



B. Results 

We characterize the system performance for different 
fibre lengths by measuring the quantum bit error rate 
QBER and the secret key rate R sec - The QBER, i.e. 
the number of erroneous detections over the total number 
of detections, can be approximated by 



QBER = QBER opt + QBER 



Met 



QBER W 



dm 



(4) 



(for more details see I VII B"1) . The optical share QBER opt 
is determined by the interference visibility entailed by the 



quality of the optical components and their alignment. 
Its typical value was 0.3 % (0.6 %) using BB84 (SARG). 
QBERdet depends on the characteristics of Bob's sin- 
gle photon detectors and includes errors due to detector 
dark counts of around 5 • 10~ 6 per ns as well as after- 
pulses. QBER w d m summarizes all additional errors from 
noise due to wavelength-division multiplexing with clas- 
sical channels, i.e. channel crosstalk and Raman scatter 
(see Fig. 

The secret key rate, i.e. the net rate of secret key bits 
provided to the encryptors to cipher data communication 
between Alice and Bob, is given by [TtJ 
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R sec = R S ift (1 - r ec ) (1 - r pa ) . 



(5) 
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FIG. 5: Performance of the QKD based encryption system in 
terms of QBER. (top) and secret key rate provided to the en- 
cryptors (bottom) in dependence of the fibre length. Symbols 
denote our experimental results, solid lines our calculations. 
Additional filtering increases the maximum fibre length to 
41 km using BB84 key sifting and 50 km using SARG. 



Here, R S ift is the detection rate after sifting (Eq. IT5|) . 
and r ec and r pa are the fractions of bits used for error 
correction and privacy amplification. Both, r ec and r pa , 
increase non-linearly with the QBER. 

Our performance results in terms of QBER (estimated 
by the CASCADE error correction protocol) and net rate 
of secret keys are plotted in Fig. [5] and listed in Tab. Q] 
The solid lines indicate our calculations which make use 
of the formulas given in IVII Bl We note that we do not 
account for the time needed for key distillation and fibre 
length measurements, which gets the more significant the 
higher the key rates. Hence, in general we overestimate 
the secret key rate especially for short fibre lengths. The 
dashed lines in Fig. [5] indicate the maximum QBER of 
9 % below which the system can distil a secret key, and 
the minimum secret key rate of 8.6 bps required for AES 
encryption with 256 bit keys which are updated once a 
minute, respectively. 

Without the optional spectral filters (F) we obtain a 
secret key rate which remains well above 1000 bps up to 
a fibre length of 10 km using BB84 key sifting. Inserting 
the optional spectral filters in front of the APDs does not 
only increase the secret key rate from 4.3 bps to 25 bps 
for a fibre length of 35 km, it also increases the maximal 
distance to 41 km at which we obtain 7.5 bps. We achieve 
a further increase in the secret key rate and maximum 
distance if we use the SARG key sifting protocol instead. 
Here, the average secret key rate is 128 bps for 35 km 
and 11 bps for 50 km fibre length. We emphasize that 
the SARG protocol equally guarantees the security of 
the key material. While for BB84 the optimum mean 
photon number /i of the quantum pulses depends on the 



6 



fibre transmission t according to [iBBSi = t, the SARG 
protocol allows to benefit from a higher mean photon 
number fisARG = 2 ■ V* ■ 

Concerning the stability of the setup we verified con- 
stant detection and secret key rates over a period as long 
as five days in the configuration without the additional 
filters (F). Having added the filters we still observe a con- 
stant detection rate in one detector which confirms that 
a sufficient stabilisation of the filter transmission spec- 
tra can be achieved using standard temperature control. 
However, after a few hours the detection rate in the sec- 
ond detector tends to decrease due to a drift of the trans- 
mission spectra of the corresponding filter, most likely 
caused by a filter fabrication flaw. 



IV. DISCUSSION AND OUTLOOK 

In Fig. [5] (left) we compare the QBER values obtained 
experimentally with theoretical calculations which take 
all discussed noise sources into account. It reproduces 
very well the measurement results giving us confidence 
that we have successfully identified the dominant impair- 
ment sources present in our implementation. Based on 
this we discuss some alternative configurations in the fol- 
lowing paragraphs. 

Firstly, we address the question whether or not it might 
be advantageous to place the quantum channel in the O- 
band around 1310 nm while keeping the classical commu- 
nication channels in the C-band around 1550 nm (for an 
O-band implementation see 19]). The maximal reach of 
the 1550 nm solution is ultimately limited by the Raman 
noise (see Fig. [3]). Calculating the mean phonon occupa- 
tion numbers we find that the Raman noise at 1310 nm 
is about 4000 times weaker as at 1550 nm. We calculate 
two scenarios: firstly, we take the dark count probability 
of the detectors used in our experiment (straight lines, 
Pdc = 5 • 10~ 6 ns -1 , rj = 0.07) and secondly, we assume a 
very small detector dark count probability (dashed lines, 
Pdc = 5 • 10~ 8 ns -1 , rj = 0.07). In addition to that we 
suppose a better channel isolation in the 1310 nm case of 
100 dB while it is at 82 dB in the 1550 nm case (like in 
our experiment). The results are shown in Fig.[S] For all 
curves we neglected the influence of detector dead time, 
the system specific duty cycle and the reduced efficiency 
of the error correction protocol (see I VII B|) . As expected, 
we find that the lower dark count rate dramatically im- 
proves the 1310 nm curve, whereas it has rather minor 
impact on the 1550 nm. However, we see that if high key 
rates are desired, the 1310 nm solution cannot keep up 
with the 1550 nm one due to the higher fibre attenuation. 
Only in an extreme case where lower key rates are accept- 
able, the 1310 nm solution can reach a larger distance, 
provided detectors with very low dark count probability 
are used. 

Secondly, we want to estimate the implications of 
higher transmission rates in the encrypted channels. As 
described before, we minimize the total power present in 
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channel wavelength (SARG, with filters), pdc denotes detec- 
tor dark count probability. The assumed fibre attenuation is 
01550 = 0.21 dB/km and amo = 0.35 dB/km. The calcu- 
lations for a dark fibre configuration (without DWDMs and 
filters) is also shown for comparison. 



the fibre by adapting the laser power of the SFP mod- 
ules to their receiver sensitivity of -28 dBm. Modules 
designated for higher transmission rates currently have 
lower sensitivity. For example, the 10 Gbps transceiver 
module Finisar FTRX-1811-3 is specified with a receiver 
sensitivity of -23 dBm. Using two of these modules for 
the encrypted link instead of the 1 Gbps modules we used 
would consequently increase the total classical power by 
3.2 dB, and hence the detected noise. Taking this into 
account but keeping all other parameters unchanged, we 
estimate for distances up to 40 km no significant degra- 
dation of the secret key rate. However, the maximum 
distance at which a key rate of 8.6 bps can be achieved, 
reduces by 4-5 km, depending on the sifting protocol. 

Next, we take a look on possible measures which could 
improve the performance of the current setup. One possi- 
bility is the reduction of the total classical channel power. 
This could be achieved by amplification of the classical 
signals in front of the receivers, or by prospective SFP 
modules with better receiver sensitivity. While a solution 
with amplifiers is cost-intensive, an improvement of the 
receiver sensitivity of more than 3 dB is unlikely in near 
future. One could also assume that narrower spectral or 
temporal filtering of the quantum channel could further 
reduce the impact of Raman noise. However, we observe 
that there is no more room for improvements here. On 
one hand the transmission width of 45 pm (corresponding 
to 5.6 GHz) of our additional filter is already the limit 
for the spectral width of our sub-nanosecond quantum 
signals. On the other hand, we can not further reduce 
the temporal gate width without clipping the pulses and, 
hence, introducing additional losses. Since the pulse du- 
ration of the quantum signals is related to the inverse of 
its spectral bandwidth, further narrower temporal filter- 
ing would entail broader spectral filtering and vice versa. 

Finally, we would like to give an outlook on prospective 
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DWDM implementations with next-generation QKD sys- 
tems based on the Differential-phase shift pro tocol [201 ] 
or the Coherent-one- way protocol (COW, [2l|). These 
systems largely benefit from high speed electronics and 
a better key generation efficiency due to their improved 
tolerance to photon number splitting attacks. As an il- 
lustration we take a look at the COW prototype as pre- 
sented in [22| . which uses a QKD encoding frequency 
of 312.5 MHz and a mean photon number of [icow — 
0.5 photons per pulse. Assuming the same parameters 
as used for the calculations with the additional filters in 
Fig. we find an increase in the maximum link distance 
to 70 km and a secret key rate of > 10,000 bps for fibre 
lengths up to 43 km. 



V. CONCLUSIONS 

We demonstrate that a QKD based encryption system 
can be efficiently operated on a single dedicated fibre 
of up to 50 km length. All four classical channels neces- 
sary to establish the encrypted link are multiplexed along 
with the quantum signal in a 100 GHz DWDM config- 
uration, rendering the system independent of any addi- 
tional network connection. We also show that a combined 
O-band/C-band solution (quantum channel at 1310 nm) 
cannot improve the performance. 

We find that with respect to the conventional dark fibre 
configuration, requiring two independent fibres, compa- 
rable secret key rates can be obtained, e.g. up to 25 km 
the decrease of the secret key rate is less than 50 %. 
We conclude that with only moderate additional efforts 
a commercial QKD system can be upgraded to network 
topologies where only one dedicated fibre is available at 
a time. 
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VII. APPENDIX 
A. Derivation of Raman Scatter power formulas 

The Raman Scatter power dP ra m at wavelength A from 
a fibre element of length dx at position x when a power 
Pin is launched into a fibre is 



dP ram {X,x) = P m ■ e~ ax • p(A) ■ AX - dx 



(6) 



p(A) accounts already for the fibre caption ratio and we 
used the same approximation for the spectral integral 
(see Eq. [Tj). The scatter from a single fibre element is 



almost isotropic. Now we have to account for the fibre 
attenuation (fibre length L) when the scatter propagates 
to the fibre output (forward scatter) and back to the fibre 
input (backward scatter) 

a) forward : 

dPram.J = dP ram (X, x) ■ e —(i-«) (7) 

integrating over whole fibre 

=> Pram,/ = Pin • e~ a L ■ p(X) • AA (8) 

b) backward : 

dPram,b d>P rara {X,X^) • 6 (9) 

integrating over whole fibre 

_ a . x sinh(a-L) 



= ^ > Prara,b — Pin ' 6 



a 



p(X) • AA (10) 



In order to obtain the detection probabilities per gate 
(pramj andp ralTli b respectively), used for the QBER cal- 
culation (see Appendix B), we calculate 



Pram.f — j ' *? ' ^-^qate 

hv 



(11) 



where At ga t e is the gate duration and 77 the detector effi- 
ciency. By replacing P ram j by P ra m,b, one obtains p ram ,b 
in the same manner. 



B. Explicit QBER and key rate formulas 

The general definition of QBER is given by the ratio 
between the number of false detections and total detec- 
tions (right+false): 



QBER 



false 



right + false 



(12) 



Introducing a sifting protocol specific parameter /3 which 
is Pbbsa = 1 for BB84 and Psarg = ^ for SARG we 
obtain 



QBER 



1 Pa(l-V)+2-p dc +p AP +p ram +p ct 



(3 ■ p a + 2 • p dc + PAP + Pr 



Pet 



(13) 

where every quantity signifies a detection probability per 
detector gate. In particular : p a = signal detection, pd c 
= dark count, p A p = after pulse, p ram = p ram j +Pram,b 
— Raman photon detection (see Eq. ITT|) , p ct — cross talk 
photon detection and V is the interference visibility. The 
signal detection probability p a is a product of the aver- 
age number of photons per pulse /i, fibre transmission 
t, detector efficiency 77 and ts the loss of Bob's internal 
components. The optimal [i also depends on the sifting 
protocol, it is psBSi = t and usarg = 

We estimate the secret key rate after error correction 
and privacy amplification by 



Rsec = Rsift (IaB — IaI 



(14) 
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Here, R S ift is the sifted bit rate, 



Rsift = 



| (P ■ Pfi + %Pdc + PAP + Pram +Pct) ■ frep ' Vduty 

1 + T dead {jpn + 2p dc + 

PAP ~h Pram H~ Pet) ' /rep 

where f rep is the pulse repetition frequency and rj du ty = 
l+2L s accoun ts for the duty cycle of our system with 
L the fibre length and L$ the length of Alice's storage 
line. We note, that Eq. [15] does not account for double 
detections and Poissonian photon number statistics. 

During error correction and privacy amplification, 
R S ift is reduced by a factor (Iab — Iae)- Iab and Iae 
are the mutual information per bit between Alice and 
Bob, and between Alice and a potential eavesdropper, 
respectively. Due to quantum bit errors, Iab is smaller 
than 1 and amounts to 



I AB = 1 - Vec ■ H (QBER) 



(16) 



with H (p) — —p\og 2 p — (1—p) log 2 (1—p) the binary 
entropy function. In the ideal case, the amount of bits 
discarded during error correction is given by the Shannon 
limit, i.e. rj ec = 1. In practice, however, we observe that 
the implemented algorithm for CASCADE error correc- 
tion consumes about 20 % more bits than given by the 
Shannon limit. Hence, we correct Eq. [16] by choosing 



>l 



Cascade 



To calculate the information per bit Iae between Alice 
and an eavesdropper we assume that an eavesdropper has 
full control over the quantum channel (i.e. the visibility 
and fibre transmission). In contrast, he can not modify 
the characteristics of Bob's detectors. Additionally, we 



suppose that he performs an optimal coherent attack 23 1 
on pulses containing one photon, and a PNS attack 24 1 
if more than one photon is present in a pulse (without 
affecting the total detection rate at Bob). For BB84 with 
weak laser pulses one then obtains [25[ 



Ia 



E,BB84 = 



JL) 
It) 



(l-H(P)) 



ii 

2/ 



1 



(17) 



with P = \ + y/D{\ - D), D = i 



, ■ ; , ^ ... j_ — t. Based on the 

2 V V n 1-ii/t 

same assumptions, we use the results in [l8| to estimate 
for the SARG protocol 



lAE,SARG = Ipns (1) + (! - Ws (1)) , (18) 



where L, 



pns (fe) 



l- 



-12"(| + |-i/l — ^rr) is the potential in- 
formation gain of an eavesdropper due to PNS attacks on 
multi-photon pulses when k photons are split and stored. 
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